Attackers pushed malicious cPGuard updates through OpsShield's update channel

SecurityWeek reported that OpsShield, an Indian IT security company, was hit on Monday. The attackers used compromised credentials to access the company's update distribution infrastructure, a CDN, and pushed a malicious script through cPGuard's update channel, according to OpsShield's incident notice.

The affected builds were cPGuard versions 5.88.12 through 5.88.19. OpsShield said it discovered the supply chain attack within 12 hours, and that the fake updates were distributed for roughly 70 minutes. The company estimates 2,950 servers executed them, which works out at about 42 machines a minute across that window.

How the attackers got in

OpsShield's incident report said the attackers first targeted its billing and licensing server. They registered a customer account and ordered a free cPGuard trial to study how the product communicated with the licensing system, then sent crafted requests to the portal and obtained command execution on that server. From there they uploaded a fake cPGuard update using a stolen access key.

The report said the attackers also copied three of OpsShield's cloud servers. The malicious script collected data and uploaded it to OpsShield's licensing server under a compromised account.

What the malicious update did

The update executed as root on servers that polled OpsShield's update infrastructure during the compromise window, the notice said. Root is the highest privilege level on a Linux server. cPGuard, OpsShield's most notable product, is designed for Linux web hosting servers, so the compromised machines were hosting servers, where root control extends to the sites and data hosted on them.

The script also left a hidden root shell and files in the temp folder of customer machines. OpsShield said the attackers retrieved 32 collected files, each from a different customer server, and copied about 7,900 client account records containing names, company, addresses, emails and hashed passwords.

What customers should do

OpsShield told customers to treat all password hashes, root SSH keys and MySQL root passwords as compromised and rotate them, along with shell history on the infected customer servers. It also said customers should reset their billing portal password.

OpsShield said servers that did not have cPGuard online during the window did not receive the fake update. "You should still reset your billing portal password," the company said in its notice.

For detection, OpsShield published indicators of compromise. The company said cPGuard 5.88.25 and later removes the hidden root shell and the additional files left by the script. Customers should verify their cPGuard version and check for the IoCs.

Clean-up and fix

OpsShield said it evicted the attackers from all servers they may have touched. It reset secrets on its account, removed the attacker's SSH key and cloned assets from its cloud account, and replaced all SSH keys and passwords across its servers.

It started reissuing all cPGuard license private and public keys because the attackers compromised them. It reset all billing portal login sessions, rotated associated API keys, and is rebuilding its billing, licensing and internal management servers.

"Attacks like this one are getting faster and cheaper to run. Our answer is to harden our own update and signing process first, and then to put what we learned here straight back into cPGuard for you," the company said in its notice.